Why didn't Google build an in-house Wiz competitor?
Because Wiz is the best in a market that values the best
Google acquired Wiz for $32B. The deal comes with hefty 32x NTM ARR price tag, and will consume 1/3rd of their available cash (Google currently has ~$96B in cash on the balance sheet).
Wiz is widely known as the best cloud security product suite on the market and is expected to grow from ~$500M ARR to $1B ARR this year. Many have understandably asked, why Google, a leader in cloud, couldn’t have just built this themselves? It’s a fair question. An equally interesting question is why they chose to pay a premium for Wiz instead of buying a cheaper, but still modern offering like Orca Security (last valuation was $2-3B).
A few reasons I think Google chose to buy Wiz instead of building in-house:
Crowded market of sticky incumbents: While the cloud security market is new in the grand scheme of security, the incumbent security platforms like PANW, CRWD, S, TENB all have scaled offerings. PANW is generating $700M ARR from cloud security, CRWD generating $600M ARR, S generating $100M ARR, and TNB, ZScaler all offering solutions as well. While those solutions are worse than Wiz (or a hypothetical Google in-house competitor), they are inside of an incredibly sticky ecosystem of other security services. Building a net new cloud security offering anchored on Google’s cloud would be a very steep, uphill battle.
Limited greenfield opportunity: Enterprises all have existing cloud security solutions. 50% of the fortune 100 is already using Wiz. There is limited greenfield opportunity (especially at the enterprise), and rip & replace for security is extremely difficult and riddled with risk for CISOs. Any new Google offering would be fighting an uphill battle for customers.
CISOs are willing to pay for the best products: Enterprise CISOs have large budgets and the ability to buy best-of-breed security solutions. They also want to purchase solutions that won’t get them fired. Wiz is widely known to be the best cloud security solution on the market, and enterprises are happy to foot the $1M+ bill. It’s unlikely CISOs would be meaningfully swayed by a proprietary Google offering that isn’t as strong as Wiz just b/c it was cheaper (and coupled w/ other Google cloud offerings).
Enterprises are multi-cloud: Every enterprise is multi-cloud. A hypothetical in-house Google offering is unlikely to have a meaningful competitive advantage outside of GCP (and CISOs might actually feel like there is risk here).
Google Cloud Security Platform Opportunity: Cloud security is one of the fastest growing security market segments, and a strong basis for a whole new set of security challenges posed by AI (non-human identities, data security, etc.). Investing in Wiz as the base of their security platform seems like a compelling way to build a modern day cloud security platform
It’s striking that Google didn’t purchase a smaller cloud security player (e.g., Orca Security) and scale that using GCP’s cloud distribution. To me, this confirms some of what I shared above about the premium value of the top product in cloud security.
Only time will tell if Google can build a cybersecurity empire, but in the meantime, congrats to the Wiz team on a well deserved win.